lasdf1234 commented on code in PR #12962:
URL: https://github.com/apache/gravitino/pull/12962#discussion_r3949450134
##########
iceberg/iceberg-common/src/main/java/org/apache/gravitino/iceberg/common/utils/IcebergCatalogUtil.java:
##########
@@ -269,6 +283,66 @@ private static Catalog loadCustomCatalog(IcebergConfig
icebergConfig) {
@VisibleForTesting
public static void applyDefaultResolvingFileIO(Map<String, String>
properties) {
properties.putIfAbsent(IcebergConstants.IO_IMPL,
ResolvingFileIO.class.getName());
+ applyGcsServiceAccountCredentials(properties);
+ }
+
+ /**
+ * When {@code gcs-service-account-file} is set, mint an OAuth2 access token
and inject Iceberg
+ * {@code gcs.oauth2.token} / {@code gcs.oauth2.token-expires-at} so the
built-in {@code
+ * GCSFileIO} can authenticate. Iceberg's FileIO does not understand
Gravitino's
+ * service-account-file property; S3/OSS/ADLS instead map static keys
directly via {@link
+ * org.apache.gravitino.catalog.lakehouse.iceberg.IcebergPropertiesUtils}.
+ *
+ * <p>Skips injection when {@code gcs.oauth2.token} is already present.
Disables Iceberg's
+ * credentials-endpoint refresh because that path is for vended table
credentials, not catalog
+ * bootstrap from a service account file.
+ *
+ * @param properties Iceberg catalog properties, mutated in place
+ */
+ @VisibleForTesting
+ static void applyGcsServiceAccountCredentials(Map<String, String>
properties) {
+ String serviceAccountFile =
properties.get(GCSProperties.GRAVITINO_GCS_SERVICE_ACCOUNT_FILE);
Review Comment:
Good catch — addressed in the latest commit.
IRC catalog wrappers now keep the minted `gcs.oauth2.token-expires-at` on
`IcebergConfig`, and `IcebergCatalogWrapperManager` uses a Caffeine `Expiry`
that caps expire-after-access by token expiry minus a 5-minute buffer. When the
entry is evicted, the next request recreates the catalog and remints the token.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
